Medium severity · published Apr 10, 2026
CVE-2026-40242
Arcane Unauthenticated SSRF with Conditional Response Reflection in Template Fetch Endpoint
6.5
CVSS
0.6%
EPSS
No
On KEV
Description
Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.17.3, the /api/templates/fetch endpoint accepts a caller-supplied url parameter and performs a server-side HTTP GET request to that URL without authentication and without URL scheme or host validation. The server's response is returned directly to the caller. type. This constitutes an unauthenticated SSRF vulnerability affecting any publicly reachable Arcane instance. This vulnerability is fixed in 1.17.3.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AR
arcane · getarcaneapp
< 1.17.3 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-40242
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-40242
Release Notes
https://github.com/getarcaneapp/arcane/releases/tag/v1.17.3
Exploit
https://github.com/getarcaneapp/arcane/security/advisories/GHSA-ff24-4prj-gpmj
More from arcane
9.9
CVE-2026-45625
Arcane: Missing admin authorization on git repository endpoints allows non-admin users to exfiltrate stored Git credentials and tamper with GitOps configs
9.8
CVE-2026-23944
Arcane allows unauthenticated proxy access to remote environments
8.8
CVE-2026-96627
Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)
8.8
CVE-2026-47125
Arcane: Missing admin authorization on global variables endpoint
8.5
CVE-2026-96626
Arcane: Container-registry credential exfiltration via URL repoint + test to attacker host